/******************************************************************/
/*                                                                */
/*  Winpooch : Windows Watchdog                                   */
/*  Copyright (C) 2004-2005  Benoit Blanchon                      */
/*                                                                */
/*  This program is free software; you can redistribute it        */
/*  and/or modify it under the terms of the GNU General Public    */
/*  License as published by the Free Software Foundation; either  */
/*  version 2 of the License, or (at your option) any later       */
/*  version.                                                      */
/*                                                                */
/*  This program is distributed in the hope that it will be       */
/*  useful, but WITHOUT ANY WARRANTY; without even the implied    */
/*  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR       */
/*  PURPOSE.  See the GNU General Public License for more         */
/*  details.                                                      */
/*                                                                */
/*  You should have received a copy of the GNU General Public     */
/*  License along with this program; if not, write to the Free    */
/*  Software Foundation, Inc.,                                    */
/*  675 Mass Ave, Cambridge, MA 02139, USA.                       */
/*                                                                */
/******************************************************************/


/******************************************************************/
/* Build configuration                                            */
/******************************************************************/

#define TRACE_LEVEL	2	// warning level


/******************************************************************/
/* Includes                                                       */
/******************************************************************/

// module's interface
#include "FilterSet.h"

// standard headers
#include <windows.h>
#include <shlobj.h>
#include <tchar.h>

// project's headers
#include "Assert.h"
#include "Trace.h"
#include "Wildcards.h"


/******************************************************************/
/* Internal data types                                            */
/******************************************************************/

typedef struct
{
  int		nFilters ;
  int		nFiltersMax ;
  HFILTER	*pFilters ;
} FILTERSET ;




HFILTERSET FilterSet_Create (int nFiltersMax) 
{
  FILTERSET	*p ;
  HFILTER	hDefFilter ;

  p = malloc (sizeof(FILTERSET)) ;
  if( ! p ) return NULL ;

  p->nFiltersMax = nFiltersMax ;
  p->nFilters = 0 ;
  
  p->pFilters = calloc (nFiltersMax, sizeof(HFILTER)) ;
  if( ! p->pFilters ) {
    free (p) ;
    return NULL ;
  } 

  // create the first filter : default 
  hDefFilter = Filter_Create(TEXT("*")) ;
  Filter_SetProtected (hDefFilter, TRUE) ;
  FilterSet_AddFilter (p, hDefFilter) ;
  
  return p ;
}


VOID FilterSet_Destroy (HFILTERSET h) 
{
  FILTERSET * p = h ;

  if( ! p ) return ;

  while( p->nFilters-- ) 
    Filter_Destroy (p->pFilters[p->nFilters]) ;

  free (p) ;
}


BOOL FilterSet_AddFilter (HFILTERSET hFilterSet, HFILTER hNewFilter) 
{
  FILTERSET * p = hFilterSet ;
  HFILTER	hExistingFilter ;

  // verify params
  ASSERT (hFilterSet!=NULL) ;
  ASSERT (hNewFilter!=NULL) ;

  TRACE_INFO (TEXT("New = %s\n"), Filter_GetProgram(hNewFilter)) ;
  
  hExistingFilter = FilterSet_GetFilterStrict 
    (hFilterSet, Filter_GetProgram(hNewFilter)) ;
  
  if( hExistingFilter ) 
    {
      TRACE_INFO (TEXT("Found existing\n")) ;

      Filter_Concat (hExistingFilter, hNewFilter) ;
    }
  else
    {
      TRACE_INFO (TEXT("No existing found\n")) ;

      if( p->nFilters >= p->nFiltersMax ) return FALSE ;
      
      p->pFilters[p->nFilters++] = hNewFilter ;
    }

  return TRUE ;
}


HFILTER FilterSet_GetFilter (HFILTERSET hFilterSet, LPCTSTR szProcess) 
{
  int i ;
  FILTERSET * p = hFilterSet ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ;
  ASSERT (szProcess!=NULL) ;

  for( i=p->nFilters-1 ; i>=0 ; i-- )
    if( Wildcards_CompleteStringCmp(Filter_GetProgram(p->pFilters[i]),szProcess) )
      return p->pFilters[i] ;

  return NULL ;
}


HFILTER FilterSet_GetFilterStrict (HFILTERSET hFilterSet, LPCTSTR szProcess) 
{
  int i ;
  FILTERSET * p = hFilterSet ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ;
  ASSERT (szProcess!=NULL) ;

  for( i=p->nFilters-1 ; i>=0 ; i-- )
    if( ! _tcsicmp(Filter_GetProgram(p->pFilters[i]),szProcess) )
      return p->pFilters[i] ;

  return NULL ;
}


UINT FilterSet_GetFilterCount (HFILTERSET hFilterSet) 
{
  FILTERSET * p = hFilterSet ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ; 
  
  return p->nFilters ;
}


HFILTER FilterSet_GetFilterByNum (HFILTERSET hFilterSet, UINT i) 
{
  FILTERSET * p = hFilterSet ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ;

  if( i>=p->nFilters ) return NULL ;

  return p->pFilters[i] ;
}

HFILTER FilterSet_GetDefaultFilter (HFILTERSET hFilterSet)
{
  FILTERSET * p = hFilterSet ;

  // verify params
  ASSERT  (hFilterSet!=NULL) ;
  
  return p->pFilters[0] ;
}


VOID FilterSet_RemoveByNum (HFILTERSET hFilterSet, UINT iFilter) 
{
  FILTERSET * p = hFilterSet ;
  HFILTER hFilter ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ;
  ASSERT (iFilter<p->nFilters) ;

  hFilter = p->pFilters[iFilter] ;
  p->pFilters[iFilter] = p->pFilters[--p->nFilters] ;
}


VOID FilterSet_Remove (HFILTERSET hFilterSet, HFILTER hFilter) 
{
  FILTERSET * p = hFilterSet ;
  int i ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ;
  
  for( i=0 ; i<p->nFilters ; i++ )
    if( p->pFilters[i]==hFilter )
      break ;

  if( i<p->nFilters ) FilterSet_RemoveByNum (hFilterSet, i) ;
}


BOOL FilterSet_EnumFilters (HFILTERSET hFilterSet, ENUMFILTERSCALLBACK pfnCb, LPVOID pContext) 
{
  FILTERSET * p = hFilterSet ;
  int i ;
  
  // verify params
  ASSERT (hFilterSet!=NULL) ;
  ASSERT (pfnCb!=NULL) ;

  for( i=0 ; i<p->nFilters ; i++ )
    if(! pfnCb (pContext, p->pFilters[i]) )
      break ;

  return TRUE ;
}


BOOL FilterSet_TestPartialKey (HFILTERSET hFilterSet, LPCTSTR szPartialKey) 
{
  FILTERSET	*p = hFilterSet ;
  BOOL		bMatches = FALSE ;
  int		i ;

  // verify params
  ASSERT (hFilterSet!=NULL) ;
  ASSERT (szPartialKey!=NULL) ;

  for( i=0 ; i<p->nFilters && !bMatches ; i++ )
    bMatches = Filter_TestPartialKey (p->pFilters[i], szPartialKey) ;
    
  return bMatches ;
}


/******************************************************************/
/* Exported function : GetDefault                                 */
/******************************************************************/

HFILTERSET FilterSet_CreateDefaultSet ()
{
  HFILTERSET	hFilterSet ;
  HFILTER	hCurFilter ;
  CONDITION	*pCondition ;
  TCHAR		szDir[MAX_PATH] ;
  TCHAR		szBuffer[MAX_PATH] ;

  TRACE ; 

  hFilterSet = FilterSet_Create (64) ;
  
  hCurFilter = Filter_Create (TEXT("*")) ;

  // listen local interface
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_LISTEN, TEXT("s*"), TEXT("127.0.0.1"))) ;

  // listen all interface
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_ALERT, 0,
  		     Condition_AllocAndSet(REASON_NET_LISTEN, TEXT("**"))) ;

  // connect to listen on local interface
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("s*"), TEXT("127.0.0.1"))) ;

  // connect to HTTPS
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0, 
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("*n"), 443)) ;

  // connect to news
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("*n"), 119)) ;

  // connect to POP
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("*n"), 110)) ;

  // connect to HTTP
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("*n"), 80)) ;

  // connect to SMTP 
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("*n"), 25)) ;

  // connect to FTP 
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_SILENT, 0,
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("*n"), 21)) ;

  // connect to any port
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_LOG, 0, 
  		     Condition_AllocAndSet(REASON_NET_CONNECT, TEXT("**"))) ;

  // create a process
  Filter_AddNewRule (hCurFilter, RULE_ACCEPT, RULE_LOG, RULE_SCAN,
		     Condition_AllocAndSet(REASON_SYS_EXECUTE, TEXT("*"))) ;


  // Startup dirs

  SHGetSpecialFolderPath (NULL, szDir, CSIDL_COMMON_STARTUP, FALSE) ;
  wsprintf (szBuffer, TEXT("%s\\*"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szDir) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  SHGetSpecialFolderPath (NULL, szDir, CSIDL_STARTUP, FALSE) ;
  wsprintf (szBuffer, TEXT("%s\\*"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szDir) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;  

  // Windows directory
  SHGetSpecialFolderPath (NULL, szDir, CSIDL_WINDOWS, FALSE) ;

  wsprintf (szBuffer, TEXT("%s\\*.dll"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.exe"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.bat"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.ocx"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.pif"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.scr"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\system.ini"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("s"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\win.ini"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("s"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\wininit.ini"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("s"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\Tasks\\*"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  // System32 directory
  SHGetSpecialFolderPath (NULL, szDir, CSIDL_SYSTEM, FALSE) ;

  wsprintf (szBuffer, TEXT("%s\\*.dll"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.exe"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.bat"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.ocx"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.pif"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\*.scr"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  wsprintf (szBuffer, TEXT("%s\\drivers\\etc\\hosts"), szDir) ;
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("s"), szBuffer) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  // Drive root
  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), TEXT("?:\\explorer.exe")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), TEXT("?:\\autoexec.bat")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), TEXT("?:\\boot.ini")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), TEXT("?:\\config.sys")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), TEXT("?:\\ntdetect.com")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet(REASON_FILE_WRITE, TEXT("p"), TEXT("?:\\ntldr")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  // REGISTRY
  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;	

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("s*"), 
				      TEXT("*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;	

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WOW\\boot"),
				      TEXT("shell")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("s*"),  
				      TEXT("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\IniFileMapping")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ws"), 
				      TEXT("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\explorer\\shell folders"),
				      TEXT("Common Startup")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ws"), 
				      TEXT("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\explorer\\user shell folders"),
				      TEXT("Common Startup")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("s*"),  
				      TEXT("HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("s*"),  
				      TEXT("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\Software\\Microsoft\\Active Setup\\Installed Components\\*"),
				      TEXT("StubPath")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ws"), 
				      TEXT("*\\Software\\Microsoft\\Command Processor"),
				      TEXT("AutoRun")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ws"), 
				      TEXT("*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"),
				      TEXT("load")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ws"), 
				      TEXT("*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"),
				      TEXT("run")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment"),
				      TEXT("Path")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment"),
				      TEXT("ComSpec")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"),
				      TEXT("BootExecute")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"),  
				      TEXT("*\\Software\\CLASSES\\?\\shellex\\contextmenuhandlers")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\exefile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\exefile\\shell\\runas\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\Folder\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\Folder\\shell\\explore\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\batfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\comfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\cmdfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\regfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\scrfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\scrfile\\shell\\config\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\vbsfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\vbsfile\\shell\\open2\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\jsfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\jarfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\piffile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\htafile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\jarfile\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.exe")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.Folder")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.bat")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.com")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.cmd")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.reg")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.scr")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.vbs")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.js")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.jar")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.pif")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), TEXT("*\\Software\\CLASSES\\.hta")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("w*"), 
				      TEXT("*\\Software\\CLASSES\\mailto\\shell\\open\\command")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Control\\WOW"),
				      TEXT("cmdline")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Control\\WOW"),
				      TEXT("wowcmdline")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ws"), 
				      TEXT("HKU\\*\\Control Panel\\Desktop"),
				      TEXT("SCRNSAVE.EXE")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"),
				      TEXT("PendingFileRenameOperations")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  pCondition = Condition_AllocAndSet (REASON_REG_SETVALUE, TEXT("ss"), 
				      TEXT("HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters"),
				      TEXT("DataBasePath")) ;
  Filter_AddNewRule (hCurFilter, RULE_REJECT, RULE_LOG, RULE_ASK, pCondition) ;

  FilterSet_AddFilter (hFilterSet, hCurFilter) ;
    
  return hFilterSet ;
}
